Recently, on a post to a London mailing list, my friend Andy pointed out that someone on a BBC blog had posted a very detailed error message they received. Not having lived in this country for long, the only BBC bloggers I've read have been tech people and I was thus surprised that someone techy would post something which could compromise our security.
I suppose I could have dashed off a nasty email demanding to know what the hell he thought he was doing and didn't he realize he was telling the world that this software was vulnerable to algorithmic complexity attacks?
Fortunately, though frequently an idiot, I'm not frequently an ass, so I merely sent the blogger a polite email asking if he meant for that entry to be public. The poor guy seemed surprised by the question so I felt it was important to point out some of the security implications. As it turns out, he was not technically inclined, so that was a bad assumption on my part, but he was gracious about it and pulled the offending bit from the blog post.
I kept this to myself as I didn't want to get the guy in trouble, but later in the week, I'm sitting in a security meeting and I debated mentioning this. I didn't want some manager going down and giving this guy a thrashing, but this information leak was not only unfortunate, it revealed some rather dodgy details of our gory internals (of a system which has since been upgraded, thank goodness). Prudence won the day and I mentioned the post. One of our bosses asked me to forward the email and so I did, with the following caveat:
Here's the information about the blog post I mentioned. I hadn't said anything before because the individual in question was apparently genuinely surprised that there was a security issue here and I didn't want to get him in trouble.
My boss didn't comment on this, but it was only this weekend that I discovered that the blogger, Eddie Mair, is is one of the most well respected radio presenters in this country.
Hoo boy. Way to make Americans look like either complete morons or arrogant bastards :)